axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute
    URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the
    specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-
    side and client-side usage of axios. This issue is fixed in 1.8.2. (CVE-2025-27152)

The detected versions of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing     absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends     the request to the specified absolute URL, potentially causing SSRF and credential leakage.     This issue impacts both server-side and client-side usage of axios. (CVE-2025-27152)

  - Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0     and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does     not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and     returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect     HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded     memory and crash (DoS), even if the caller requested `responseType: 'stream'` (CVE-2025-58754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01326-1 advisory.

    - CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when     baseURL is set (bsc#1239308)
    - CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session     if two users authenticate simultaneously via ldap (bsc#1234840)
    - CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0603 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-5889:
    A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been     rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation     leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of     an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the     public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue.
    The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the     affected component.

    CVE-2024-53382:
    axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute     URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to     the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both     server-side and client-side usage of axios. This issue is fixed in 1.8.2.

    CVE-2025-27152:
    Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that     contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be     shadowed by attacker-injected HTML elements.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - node-axios - axios is a promise based HTTP client for the browser and node.js. The issue     occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set,     axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage.
    This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.  Red Hat     Enterprise Linux - axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests  Ubuntu     Linux - axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing     absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the     request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts     both server-side and client-side usage of axios. This issue is fixed in 1.8.2. (CVE-2025-27152)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1326-1 advisory.

    - CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when     baseURL is set (bsc#1239308)
    - CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session     if two users authenticate simultaneously via ldap (bsc#1234840)
    - CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1227-1 advisory.

    - CVE-2025-27152: axios: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when     baseURL is set (bsc#1239308)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
461949	Echo: axios: security update to 0.30.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
461949	Echo: axios: security update to 0.30.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
294986	Oracle GoldenGate (January 2026 CPU)	Nessus	Misc.	Local	high
250270	SUSE SLED15 / SLES15 Security Update : pgadmin4 (SUSE-SU-2025:01326-1)	Nessus	SuSE Local Security Checks	Local	high
249977	TencentOS Server 4: grafana (TSSA-2025:0603)	Nessus	Tencent Local Security Checks	Local	high
245369	Linux Distros Unpatched Vulnerability : CVE-2025-27152	Nessus	Misc.	Local	high
234538	SUSE SLED15 / SLES15 Security Update : pgadmin4 (SUSE-SU-2025:1326-1)	Nessus	SuSE Local Security Checks	Local	high
234362	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pgadmin4 (SUSE-SU-2025:1227-1)	Nessus	SuSE Local Security Checks	Local	high
421061	SCA: security update for axios (GHSA-jr5f-v2jv-69x6)	Tenable Cloud Security	SCA Checks	Local	high
421061	SCA: security update for axios (GHSA-jr5f-v2jv-69x6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-27152

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high